Techniques are described for presenting events detected by a monitoring system. A system receives a selection of a particular time period, identifies security events detected by a monitoring system during the selected time period, and classifies a subset of the identified security events as abnormal events. The system further generates a density of the identified security events over the selected time period, generates a density of the subset of the identified security events classified as abnormal events, and identifies monitoring system data associated with the selected time period. The system additionally generates a graphical representation of the density of the identified security events, the density of the subset of the identified security events classified as abnormal events, and the identified monitoring system data, and provides the graphical representation for display.